github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-01 02:53:36 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

KVM: SVM: Mark module parameters as __ro_after_init for security and performance

Browse Source 
SVM module parameters such as avic, sev_enabled, npt_enabled, and
pause_filter_thresh are configured exclusively during initialization
(via kernel command line) and remain constant throughout runtime.
Additionally, sev_supported_vmsa_features and svm_gp_erratum_intercept,
while not exposed as module parameters, share the same initialization
pattern and runtime constancy.

Mark these variables with '__ro_after_init' to:
- Harden against accidental or malicious runtime modification
- Enable compiler and CPU optimizations (improved caching, branch prediction)
- Align with kernel security best practices for init-only configuration

The exception is 'iopm_base', which retains '__read_mostly' as it requires
updates during module unloading.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Link: https://patch.msgid.link/20260202095004.1765-1-lirongqing@baidu.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
This commit is contained in:
Li RongQing 2026-02-02 04:50:04 -05:00 committed by Sean Christopherson
parent 11439c4635
commit 52de184bad
3 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
arch/x86/kvm/svm/avic.c
View File

@ -86,13 +86,13 @@ static const struct kernel_param_ops avic_ops = {
* Enable / disable AVIC. In "auto" mode (default behavior), AVIC is enabled
* for Zen4+ CPUs with x2AVIC (and all other criteria for enablement are met).
*/
static int avic = AVIC_AUTO_MODE;
static int __ro_after_init avic = AVIC_AUTO_MODE;
module_param_cb(avic, &avic_ops, &avic, 0444);
__MODULE_PARM_TYPE(avic, "bool");
module_param(enable_ipiv, bool, 0444);
static bool force_avic;
static bool __ro_after_init force_avic;
module_param_unsafe(force_avic, bool, 0444);
/* Note:

8
arch/x86/kvm/svm/sev.c
View File

@ -52,18 +52,18 @@
#define SNP_GUEST_VMM_ERR_GENERIC (~0U)
/* enable/disable SEV support */
static bool sev_enabled = true;
static bool __ro_after_init sev_enabled = true;
module_param_named(sev, sev_enabled, bool, 0444);
/* enable/disable SEV-ES support */
static bool sev_es_enabled = true;
static bool __ro_after_init sev_es_enabled = true;
module_param_named(sev_es, sev_es_enabled, bool, 0444);
/* enable/disable SEV-SNP support */
static bool sev_snp_enabled = true;
static bool __ro_after_init sev_snp_enabled = true;
module_param_named(sev_snp, sev_snp_enabled, bool, 0444);
static unsigned int nr_ciphertext_hiding_asids;
static unsigned int __ro_after_init nr_ciphertext_hiding_asids;
module_param_named(ciphertext_hiding_asids, nr_ciphertext_hiding_asids, uint, 0444);
#define AP_RESET_HOLD_NONE 0

32
arch/x86/kvm/svm/svm.c
View File

@ -110,52 +110,52 @@ static DEFINE_PER_CPU(u64, current_tsc_ratio);
* count only mode.
*/
static unsigned short pause_filter_thresh = KVM_DEFAULT_PLE_GAP;
static unsigned short __ro_after_init pause_filter_thresh = KVM_DEFAULT_PLE_GAP;
module_param(pause_filter_thresh, ushort, 0444);
static unsigned short pause_filter_count = KVM_SVM_DEFAULT_PLE_WINDOW;
static unsigned short __ro_after_init pause_filter_count = KVM_SVM_DEFAULT_PLE_WINDOW;
module_param(pause_filter_count, ushort, 0444);
/* Default doubles per-vcpu window every exit. */
static unsigned short pause_filter_count_grow = KVM_DEFAULT_PLE_WINDOW_GROW;
static unsigned short __ro_after_init pause_filter_count_grow = KVM_DEFAULT_PLE_WINDOW_GROW;
module_param(pause_filter_count_grow, ushort, 0444);
/* Default resets per-vcpu window every exit to pause_filter_count. */
static unsigned short pause_filter_count_shrink = KVM_DEFAULT_PLE_WINDOW_SHRINK;
static unsigned short __ro_after_init pause_filter_count_shrink = KVM_DEFAULT_PLE_WINDOW_SHRINK;
module_param(pause_filter_count_shrink, ushort, 0444);
/* Default is to compute the maximum so we can never overflow. */
static unsigned short pause_filter_count_max = KVM_SVM_DEFAULT_PLE_WINDOW_MAX;
static unsigned short __ro_after_init pause_filter_count_max = KVM_SVM_DEFAULT_PLE_WINDOW_MAX;
module_param(pause_filter_count_max, ushort, 0444);
/*
* Use nested page tables by default. Note, NPT may get forced off by
* svm_hardware_setup() if it's unsupported by hardware or the host kernel.
*/
bool npt_enabled = true;
bool __ro_after_init npt_enabled = true;
module_param_named(npt, npt_enabled, bool, 0444);
/* allow nested virtualization in KVM/SVM */
static int nested = true;
static int __ro_after_init nested = true;
module_param(nested, int, 0444);
/* enable/disable Next RIP Save */
int nrips = true;
int __ro_after_init nrips = true;
module_param(nrips, int, 0444);
/* enable/disable Virtual VMLOAD VMSAVE */
static int vls = true;
static int __ro_after_init vls = true;
module_param(vls, int, 0444);
/* enable/disable Virtual GIF */
int vgif = true;
int __ro_after_init vgif = true;
module_param(vgif, int, 0444);
/* enable/disable LBR virtualization */
int lbrv = true;
int __ro_after_init lbrv = true;
module_param(lbrv, int, 0444);
static int tsc_scaling = true;
static int __ro_after_init tsc_scaling = true;
module_param(tsc_scaling, int, 0444);
module_param(enable_device_posted_irqs, bool, 0444);
@ -164,19 +164,19 @@ bool __read_mostly dump_invalid_vmcb;
module_param(dump_invalid_vmcb, bool, 0644);
bool intercept_smi = true;
bool __ro_after_init intercept_smi = true;
module_param(intercept_smi, bool, 0444);
bool vnmi = true;
bool __ro_after_init vnmi = true;
module_param(vnmi, bool, 0444);
module_param(enable_mediated_pmu, bool, 0444);
static bool svm_gp_erratum_intercept = true;
static bool __ro_after_init svm_gp_erratum_intercept = true;
static u8 rsm_ins_bytes[] = "\x0f\xaa";
static unsigned long iopm_base;
static unsigned long __read_mostly iopm_base;
DEFINE_PER_CPU(struct svm_cpu_data, svm_data);